From dba569462d0e9c4dbd77a54bb42ef5c3b1916142 Mon Sep 17 00:00:00 2001
From: Markus Heiser <markus.heiser@darmarit.de>
Date: Wed, 19 Apr 2023 17:20:03 +0200
Subject: [mod] limiter: reduce request rates for requests without a ping

Signed-off-by: Markus Heiser <markus.heiser@darmarit.de>
---
 searx/templates/simple/base.html | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'searx/templates/simple/base.html')

diff --git a/searx/templates/simple/base.html b/searx/templates/simple/base.html
index a31ff07ee..dfe4ea265 100644
--- a/searx/templates/simple/base.html
+++ b/searx/templates/simple/base.html
@@ -17,6 +17,9 @@
   {% else %}
   <link rel="stylesheet" href="{{ url_for('static', filename='css/searxng.min.css') }}" type="text/css" media="screen" />
   {% endif %}
+  {% if get_setting('server.limiter') %}
+  <link rel="stylesheet" href="/limiter.css" type="text/css" media="screen" />
+  {% endif %}
   {% block styles %}{% endblock %}
   <!--[if gte IE 9]>-->
   <script src="{{ url_for('static', filename='js/searxng.head.min.js') }}" client_settings="{{ client_settings }}"></script>
-- 
cgit v1.2.3


From 5226044c13817688a5ca3461743844dca4ed3d2b Mon Sep 17 00:00:00 2001
From: Markus Heiser <markus.heiser@darmarit.de>
Date: Wed, 19 Apr 2023 18:59:23 +0200
Subject: [mod] limiter: add random token to the limiter URL

By adding a random component in the limiter URL a bot can no longer send a ping
by request a static URL.

Related: https://github.com/searxng/searxng/pull/2357#issuecomment-1518525094
Signed-off-by: Markus Heiser <markus.heiser@darmarit.de>
---
 searx/templates/simple/base.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'searx/templates/simple/base.html')

diff --git a/searx/templates/simple/base.html b/searx/templates/simple/base.html
index dfe4ea265..9f7cdbb8e 100644
--- a/searx/templates/simple/base.html
+++ b/searx/templates/simple/base.html
@@ -18,7 +18,7 @@
   <link rel="stylesheet" href="{{ url_for('static', filename='css/searxng.min.css') }}" type="text/css" media="screen" />
   {% endif %}
   {% if get_setting('server.limiter') %}
-  <link rel="stylesheet" href="/limiter.css" type="text/css" media="screen" />
+  <link rel="stylesheet" href="{{ url_for('limiter_css', token=limiter_token) }}" type="text/css" media="screen" />
   {% endif %}
   {% block styles %}{% endblock %}
   <!--[if gte IE 9]>-->
-- 
cgit v1.2.3


From 1ec325adccc427fe05cf08da9a2d9d63da7365f4 Mon Sep 17 00:00:00 2001
From: Markus Heiser <markus.heiser@darmarit.de>
Date: Tue, 23 May 2023 18:16:37 +0200
Subject: [mod] limiter -> botdetection: modularization and documentation

In order to be able to meet the outstanding requirements, the implementation is
modularized and supplemented with documentation.

This patch does not contain functional change, except it fixes issue #2455

----

Aktivate limiter in the settings.yml and simulate a bot request by::

    curl -H 'Accept-Language: de-DE,en-US;q=0.7,en;q=0.3' \
         -H 'Accept: text/html'
         -H 'User-Agent: xyz' \
         -H 'Accept-Encoding: gzip' \
         'http://127.0.0.1:8888/search?q=foo'

In the LOG:

    DEBUG   searx.botdetection.link_token : missing ping for this request: .....

Since ``BURST_MAX_SUSPICIOUS = 2`` you can repeat the query above two time
before you get a "Too Many Requests" response.

Closes: https://github.com/searxng/searxng/issues/2455
Signed-off-by: Markus Heiser <markus.heiser@darmarit.de>
---
 searx/templates/simple/base.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'searx/templates/simple/base.html')

diff --git a/searx/templates/simple/base.html b/searx/templates/simple/base.html
index 9f7cdbb8e..3c6ed11c7 100644
--- a/searx/templates/simple/base.html
+++ b/searx/templates/simple/base.html
@@ -18,7 +18,7 @@
   <link rel="stylesheet" href="{{ url_for('static', filename='css/searxng.min.css') }}" type="text/css" media="screen" />
   {% endif %}
   {% if get_setting('server.limiter') %}
-  <link rel="stylesheet" href="{{ url_for('limiter_css', token=limiter_token) }}" type="text/css" media="screen" />
+  <link rel="stylesheet" href="{{ url_for('client_token', token=link_token) }}" type="text/css" />
   {% endif %}
   {% block styles %}{% endblock %}
   <!--[if gte IE 9]>-->
-- 
cgit v1.2.3